





Are you being hugged? 
Here's how to find RF 
bugging devivces that 
are invading your privacy 



BEING WIRETAPPED IS NO JOKE. TODAY'S 

micro-miniaturized electronics have 
made it easy for anyone with a little 
know-how and willful attitude to tap 
your phone and invade your privacy. 
Whether you call it eavesdropping, 
phone tapping, radio interception, or 
covert operations, we'll show you 
how to hunt down those tiny bugs. 

Although there are many adver- 
tised gadgets that claim to locate clan- 
destine transmitters, licensed private 
investigators, with few exceptions, 
have neither the technical expertise 
nor background to properly use them. 
Consequently, more and more inves- 
tigators are turning to radio techni- 
cians who are knowledgeable in 
counter-surveillance technology. 

That's why a competent radio tech- 
nician with an inquisitive mind and 
the proper equipment can make a sup- 
plemental income (perhaps $100 + 
per hour} by availing himself, his 



equipment, and his expertise to inves- 
tigators who are trying to locate clan- 
destine transmitters. 

Tools of the trade 

The first order of business is to have 
the right tools. But what are the right 
tools for detecting bugs that are posi- 
tioned by persons good at hiding 
them? Bar none, the most invaluable 
tool is a .spectrum analyzer (spec-an). 
The one used by the author is an IFR 
model A7550, which becomes porta- 
ble when using its built-in Nickel 
Cadmium (Ni-Cd) battery — an essen- 
tial convenience. 

You'll also need a good receiver to 
scan the RF spectrum looking for the 
bug's frequency. Many spec-ans have 
radio-scanner options (receivers) that 
are designed to be hooked up without 
modification. Now admittedly, $500 
dollars for that option might sound 
like a lot of money; but when you're 
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talking about a $10,000 investment, if 
it's not really that much. After all, 
you're trying to discern what type of 
intelligence is contained in a detected 
signal, you need a good receiver. Of 
tremendous benefit would be some 
kind of mixer, down converter, or pre- 
scaler to extend the receiver's fre- 
quency range. 

For obvious reasons, it's para- 
mount to tape-record the bugged au- 
dio; also, a first-rate direction-finder 
is necessary so you can track down 
and locate clandestine, or spurious 
emissions. 

Another option that is extremely 
useful is a General Purpose Interface 
J5us (GPIB) interface with a plotter, 
which will allow you to make hard- 
copy two-color printouts of the sus- 
pect frequencies that you have dis- 
covered, or wish to document. The 
GPIB will interface the spec-an 's out- 
put to the plotter. 



There are a lot of gizmos that are 
advertised on the market as so-called 
"counter-intelligence devices." The 
author is compelled to warn you that 
most of the equipment will not per- 
form as advertised, and the equipment 
that will perform is often unethically 
sold for 3 to 5 times the list price — 
caveat emptor! 

If you think that you're being 
bugged, you may be desperate for 
anything that advertises to solve your 
problem quickly. The false promise of 
those gizmos seems like a good risk. 
But wait a minute: That's exactly what 
those unethical companies are de- 
pending on to motivate a sale! Don't 
fall into their trap. There's no short- 
cut gizmo that can replace the proper 
test equipment in the hands of a 
qualified radio technician. 

Sleuthing 

Technicians make some of the best 
detectives in the world — no kidding: 
They have to investigate why some- 
thing doesn't work and trace down the 
fault: that takes an inquisitive mind. 
And if one has a good sense of busi- 
ness, there's plenty of work in coun- 
ter-surveillance. That's - because pri- 
vate citizens are being illegally 
bugged every day; not to mention all 
the industrial and foreign espionage 
that seems so prevalent in today's 
world. Yes, indeed, when word gets 
around that a technician knows how to 
ferret out phone-taps, that person's 
skills will be in demand. 

Most people just aren't aware of all 
the inexpensive devices that can be 
legally purchased to invade their pri- 
vacy. Figure 1 shows three tiny bugs 
that can hear everything you say. Al- 
though clandestine bugs can come in 
small packages, a willful intruder will 
use what's handy and what works. 
Bugs range from sugar-cube sized 
"wireless microphones" for $20, to 
candy-box sized "wireless inter- 
coms," and handhelds, that will al- 
low anyone within a half-mile radius 
to listen to every spoken word in your 
home. And you can bet that there are 
many more sophisticated and much 
more expensive devices, too! Let's 
g face it; not just anyone can find one of 
z those cleverly hidden bugs in your 
§ home or office. It takes someone like 
. o a technician with expert knowledge of 
j radio transmissions, having the skills 
6 and equipment needed to track down 
S tiny radio bugs. 

cc Did you know that a perfectly legal 




FIG. 1— THESE ARE CLANDESTINE radio 
bugs. In (a), a parasitic phone-tap is 
shown disassembled. In (b), a Radio 
Shack FM-transmitter (part No. 33-1076) 
can be conveniently dropped behind the 
cushion of a chair. In (c), this tiny FM 
transmitter can be hidden in a kitchen 
cabinet. 

(FCC registered) phone tap is avail- 
able from many companies for only 
$25? That's because there's a big mar- 
ket lor bugging your own phone. Just 
think for a moment: At one time or 
another haven't you called some big- 
time attorney, or doctor, or insurance 
company, only to hear strange beep- 
tones or clicks. That's right, you're 
being recorded— and it's all legal! 

Most people are under the impres- 
sion that intercepting your own tele- 
phone conversation, or recording the 
conversion without beep tones, is il- 
legal. That simply isn't true! You 
don't have to notify anyone that 
you're tapping your own phone. How 
about that! And if you can buy a sim- 
ple phone-tap, so can a criminal out to 
victimize the average Joe. 

Bug frequency 

Let's suppose a client suspects a 



radio bug has been planted in his tele- 
phone. However, the client might lack 
the know-how to either disassemble 
the phone, or even tell the difference 
between a wiretap and the normal 
telephone's circuitry. It's possible that 
the client has found a wiretap, but 
dosen't know what to do. A common 
wiretap is shown in Fig \-a. It's a 
"parasitic telephone transmitter" (not 
to be confused with parasitic or spu- 
rious emissions from a legal RF trans- 
mitter). 

The nomenclature "parasitic" was 
derived from the fact that the bug 
steals power (as a parasite feeds on 
others) from the telephone company 
and, consequently, needs no external 
battery or antenna. Those devices use 
the telephone's own headset coil-cord 
and associated wiring as the antenna, 
and the 48-volt central-station battery 
for power (which drops to about .10 
volts when the handset is off hook). 

Depending upon how the tiny 
phone-bug is designed and where it's 
located, it can be received on an FM 
radio, or other receiver, up to one-hal f j 
mile away. The beauty of that bug is 
that it can't be detected unless it's 
actually operating, which means the j 
phone must be off-hook. And al- 
though able to operate on virtually 
any frequency, it's common to sand- 
wich the transmissions between high- 
powered FM-broadcast stations; that's 
so they won't create radio interference 
that would tip off the authorities. Be- 
sides, an FVI transmission can be re- 
ceived by any inexpensive FM car 
radio — usually sitting in front of, or 
nearby, the victim's house or busi- 
ness. 

Here's a step-by-step procedure 
using a spec-an to make any bug stand 
out like a sore thumb: 
Step 1: Set scan- width for the 88 MHz 
to 108 MHz FM broadcast spec I rum. 
Step 2: Set bandwidth resolution to 3 
kHz. You will now have a factual dis- 
play of all electromagnetic radiations 
occurring in the 88 MHz to 108 MHz 
frequency range. 

Step 3: Set the "peak hold" to cap- 
ture and store all legitimate signals 
that are on the air (see Fig. 2-a). 
Step 4: Digitally invert all stored in- 
formation (see Fig. 2-b). 
Step 5: Pick up the suspected tele- 
phone (off hook) and you'll notice 
that the signal previously not present 
is now displayed (see Fig. 2-c). 

What we have accomplished is a 
digital cancellation of everything that 
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should be on the air against a brand 
new signal that was not there prior to 
our picking up the phone, but which 
now sticks out like a sore thumb. 

Incidentally, for evidence in court 
(and customer records) the plots that 
are reproduced can be made at the 
actual scene of the crime with the 
(il'lli option uil.so known a- 
II : .t : .i-;-4SSi. One CiPiH is available 
ironi IFR in connect ihcir .spec-an to a 
Hewletl Packard 7-t~C-\ Plotter. 
Whalcver spectrum anal v/er and plnl- 
ler you're using, contact the manulac- 
tuici'.s representative lor interlacing 
suggestions. 

Bug locating 

II' \ou are sharp enough lo find a 
bug. the lasi thing in lhc world that 
you want is the bug lo hear itself! ill' 
lhc bug is active, it is logical to as- 
sume thai someone is listening, i II 
\nu ha\e a receiver tuned to the bug 
with speaker audio, and \ou gel loo 
close, you'll get audio feedback, 
which will immediately lip off lhc >p\ 
that you're on to him! No good! 
Here's v. hal to do. 

Once the bug's iivijuenc} is lound. 
use headphones with a long, long, 
extension cord (jnaybe 5U-1U0 fed or 
so) to listen to the audio. Now walk 
around the house tapping the walls, 
rattling objects, or talking in a normal 
voice, while listening for an increase 
in volume level. Make your rattling 
sounds appear as natural as possible, 
so that the "bad guys" don't become 
suspicious. If the bug is in the kitch- 
en, then as you move from the living 
room into the kitchen, the bug will 
pick up more audio thereby transmit- 
ting a higher-amplitude signal. You'll 
hear that over your headphones. 

The receiver option of your spec-an 
will undoubtedly have a speaker out- 
put. Figure 3 shows how to convert 
the speaker output to a headphone 
output only. Although by no means 
any engineering marvel, the modi- 
fication is extremely effective and re- 
tains the integrity of the receiver! The 
audio is re-directed (using shielded 
coaxial -cable) from the speaker to a 
set of headphones. Figure 4 shows the 
author's home-built adaptor box. Al- 
ternatively, a set of cordless infrared 
headphones, such as Maxon's model 
49-SA can be used, which would not 
only eliminate the possibility of trip- 
ping over a long headphone cord; but 
they are also useful in detecting in- 
frared bugs— yes, those exist, too! 
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FIG. 2— A SPECTRUM ANALYZER WILL INTERCEPT THE BUGS FREQUENCY. In (a), the 
broadcast (88-108MHz) FM spectrum is scanned and stored. In (b), the stored spectrum is 
digitally inverted. In (c), the bugs frequency sticks out like a sore thumb when the phone- 
tap begins transmitting. 
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FIG. 3 — USE HEADPHONES FOR LISTENING TO THE BUG'S TRANSMISSIONS. In (a), this 
circuit will modify your receiver's speaker output for headphone use only. As shown in (b) 
, when the phone plug is inserted, the closed-circuit spring opens, thereby cutting off ihe 
speakers while re-directing the audio to the headphones. 
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FIG. 4— USE THE AUTHOR'S home-built 
adaptor box with either a pair of stereo 
headphones, or a cordless infrared trans- 
mitter and receiver. 




ft FIG. 5 — HERE'S YOUR PERFECT 



uj sleuthing setup: a spectrum analyzer, au- 
□j tomatic direction-finder, antenna switch- 
CD ing box, and headphone audio-adaptor to 
Q listen privately to clandestine transmis- 
ir sions. 



The headphone adaptor box can be 
attached with Velcro tape to the side 
of the spec-an. In addition to provid- 
ing headphone-only audio, J 2 can in- 
put to a Voice Operated 7'ransmit 
(VOX) actuated tape-recorder, J3 can 
input to an oscilloscope, Automatic 
Direction Finder (ADF), or whatever 
else is required. Note: Use only a 1/4" 
stereo phone-plug for audio- jack JI; 
that's because if a monophonic 
phone-plug is inserted, it will short- 
circuit the audio amplifier. 

An actual bust 

As a case in point, the author's ser- 
vices were requested by an out-of- 
state detective agency. They had a cli- 
ent who quite honestly thought she 
was losing her mind. 

Separated from her husband and 
having their two children in her 
custody, the children stood to inherit 
close to three million dollars, which 
would be administered by their legal 
guardian as a trustee. (Not a bad situa- 
tion for the legal guardian.) To her, it 
seemed that every single word she 
said inside her home, or over the 
phone, was somehow being over- 
heard. No one could find any clan- 
destine listening device, and her 
suspicions seemed to be getting the 
best of her. She thought, "Is my ex- 
husband trying to collect evidence to 
prove that I'm an unfit mother, and 
then use that as a tactic in court to 



remove my guardianship?" The hus- 
band would then stand to become the 
trustee to three -million smackers. 

The author and out-of-state detec- 
tive set up a spectrum analyzer, and 
proceeded to search for a radio signal 
that shouldn't be there. After an hour 
or so, an intermittent signal kept pop- 
ping up in the middle of the FM- 
broadcast band that didn't correlate 
with any known or published local 
radio-stations in the area. Without go- 
ing into detail, it was established that 
a frequency-hopping transmitter was 
operating, and was remotely con- 
trolled by an AC line-current carrier 
transmitter. 

in other words, that was a bug that 
selectively transmitted information 
on numerous frequencies. The pur- 
pose was to make it much more diffi- 
cult for someone, to locate the bug 
because it would continually "hop" 
to a new frequency. If such a signal is 
monitored on a single frequency, all 
that is heard is gibberish. 

The control of that device was dis - 
covered to be an AC line-current car- 
rier transmitter that could activate or 
disable the bug from a convenient lo- 
cation in the neighborhood. Now that 
you have found something as insid- 
ious as that, what do you do? Psychol- 
ogy is always the best weapon. If we 
were to rip the bug out, the "bad 
guys" would instantly know that it 
was found. 

The author made a hand-written 
note, showed it to the parties in- 
volved, and instructed them to walk 
outside onto the patio where their 
conversation could not be overheard. 
There he informed the victim that she 
was neither paranoid nor insane, and 
she immediately fell into the author's 
arms, crying in relief The author ad- 
vised that if they tore apart the kitchen 
cabinets, (where the bug was located) 
that the perpetrator would be aware 
that the bug had been discovered. 

So "what now?" The author sug- 
gested that she make a tape recording 
(at another residence) of the kids 
screaming and carrying on, as if 
something terrible was happening. 
The next step of the plan was to take 
the children and place them in some- 
one else's custody, whose testimony 
and verification could not be disputed 
in a court of law. 

Having done that, she should stay 
in her house alone, play back the tape 
as loud as possible, grab a few pots 
and pans and make as much noise as 
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possible (portraying a scene of total 
chaos and child abuse). The whole 
purpose of that action was to find out 
who would show up. 

Well, it worked! It was the in-laws 
(outlaws) that showed up, and not the 
husband, much to the surprise of ev- 
eryone. I can only presume that they 
cared more about the three-million 
dollar inheritance than they did about 
the welfare of their grandchildren. 

Spec-an modifications 

Unfortunately, the IFR A7550, 
along with other spectrum analyzers, 
has one fault in common: There is an 
unacceptable amount of leakage from 
the internal oscillators that cause 
alarming and inaccurate readings 
with an antenna placed as far as 20 to 
30 feet away. The problem is caused 
by RF case leakage that can easily be 
corrected. But if you don't correct it, 
that leakage will ruin your day! 

Spectrum analyzer RF leakage can 
be cured by making sure that the front 
and rear mounting bezels make good 
contact with the case. Dissimilar met- 
als should not be used, because ox- 
ides caused by the bi-metallic contact 
will form a resistive film that isolates 
the bezel from the chassis. That turns 
the bezel and aluminum case into an 
antenna which, in turn, radiates all of 
the internal RF of the spec-an 's cir- 
cuitry. Also make sure that your plot- 
ter is line-filtered so that RF energy 
emitted by its microprocessor circuit- 
ry is not radiated into the power line. 

RF direction-finding 

Sometimes clandestine, spurious 
or overbearing emissions can be so 
powerful that they cause problems 
many miles from their source. Enter 
the automatic direction-finding sys- 
tem manufactured by Doppler Sys- 
tems Inc.. PO Box 31819. Phoenix, 
AZ. 85046, (602) 488-9755. Figure 5 
shows the Doppler direction-finder 
attached by Velcro to the right top of 
the spec-an. The circle of LEDs indi- 
cates the bearing to the RF source, 
while a 7-segment LED-display indi- 
cates the bearing in large numerals. 
The Doppler system has a frequency 
range of 27 MHz to 500 MHz, and 
can be connected to anv standard 
VHP or UHF FM-receivcr. No re- 
ceiver modifications are required — 
simply plug the Doppler electronics 
into the receiver's antenna and exter- 
nal speaker jacks. 

As shown in Fig. 6, four Mi-wave 




FIG. 6 — DIRECTION FINDING using Doppler System's four matched quarter-wave whips, 
shown in (a), are supported on magnetically mounted bases for mobile operation. In (b), 
four collapsible antennas are mounted on a sturdy platform, on top of the author's roof. 



whip antennas can be mounted on a 
car's roof for mobile operation, or on 
the roof of a house. The antennas can 
electronically simulate a rotating di- 
rectional-antenna. As the antenna 
moves toward the RF source, the ap- 
parent signal frequency increases; as 
the antenna moves away from the 
source, the apparent signal frequency 
decreases. That up-down (Doppler) 
frequency shift is detected by the FM 
receiver as a 300-Hz audio tone. The 
phase of the tone is related to the 
bearing angle and is used by the direc- 
tion-finder electronics to compute and 
display the bearing. 

The purpose of the direction-find- 
ing platform is to get an initial bearing 
to the desired signal, and the relative 
signal strength. The !4-wave whip an- 
tennas must be tuned to the exact fre- 
quency of the clandestine transmis- 
sions. You know the exact frequency 
by using the spectrum analyzer. The 
antennas are collapsible and will al- 
low tuning by extension-retraction, 
and spacing the bases by sliding them 
along the platform. To work properly, 
the antennas must be spaced approxi- 
mately !/4-wavelength apart. 

One of the capabilities of a spec- 
trum analyzer is the ability to identify 
the frequency of the offending radio- 
emission. That includes spurious 
emissions that are common in areas 
where multiple transmitters are 
placed in close proximity with each 
other. Besides the non-linear mixing 
that occurs in a transmitter's final- 
amplifier (called intermodulation) 
that create strong spurious signals, 
other far more exotic kinds of hetero- 
dyning also occur. 

One time the author found a "dif- 
ference" frequency coming from an 
oxidized dome of a town hall. There 



were two AM-broadcast stations less 
than a mile away; one was on 1590 
kHz and the other on 900 kHz. Within 
a half mile of the town hall, everyone 
in town could hear one of the stations 
at 690 kHz! That was caused by rec- 
tification from the dome's copper-ox- 
ide layer. 

When "DF-ing" a spurious signal 
in a moving vehicle, it is absolutely 
imperative that you have an assistant, 
or navigator to read a road map and 
give directions, or more important— 
to prevent you from kissing a tele- 
phone pole. Using Doppler System's 
Automatic Direction f inder (ADF), 
the author has been able to track down 
signals to a specific section of a 
house — from the road out front! 

Proximity signals 

If you narrow down a suspected 
transmitter to within a given area, 
here's one method of determining its 
proximity. Place three identical anten- 
na's having identical lengths (and 
types) of coaxial cable connected to a 
coaxial-switch box. Use the best 
coax, like RG 223-U coaxial cable, 
which is double-shielded (98% each) 
silver-plated (both shields and center- 
conductor) cable to ensure total integ- 
rity of the received signal. That may 
sound like overkill, but if you're go- 
ing to do something, why not do it 
right? 

Separate the three antennas by 
about 30 feet. A low-powered bug will 
show a marked change in signal 
strength on the spec-an, when anten- 
nas are independently selected. The 
stronger signal will indicate the rela- 
tive bearing of the transmitter's loca- c 
tion. Transmissions from far away m 
will indicate almost identical signal g 
strength. R-E 8 
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